A secure client-server connection method compatible with RESTful (REpresentational State Transfer) APIs (Application Programming Interface) that is resistant to cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The server generates a token for the client and a random value which it pairs with the token. The random value is hashed. The hash value is transmitted to the client contained in the token and the random value is transmitted to the client contained in an HTTPOnly cookie. Even if an attacker steals the token and/or the hash, security is maintained, since the server verifies communications from the client by validating the token on the basis of its hash value. Validation is performed by the server hashing the random value contained in the HTTPOnly cookie paired with the token to obtain a further hash value, and checking that this further hash value matches the token's hash value.
Legal claims defining the scope of protection, as filed with the USPTO.
1. A client-server connection method performed by a server to establish a secure communication channel with a client, the method comprising: receiving a request from the client to establish a secure communication channel, wherein the client request is a request for the server to issue an access token within an authorization protocol; generating a client-side credential in response to receiving the request from the client, wherein the client-side credential comprises the access token used for establishing security on the communication channel; generating a server-side credential and subjecting the server-side credential to a one-way function to create a hash code; containing the server-side credential in a cookie of a type that cannot be accessed by the client; containing the hash code in the client-side credential; transmitting the client-side credential and the cookie to the client; receiving the client-side credential containing the hash code and the cookie containing the server-side credential from the client over the secure communication channel, wherein the client-side credential is contained in an authorization header; validating the access token; triggering an authentication component to perform an additional check based on the cookie in response to the access token containing a hash value, wherein the additional check comprises checking if a cookie with a random value exists; reapplying the one-way function to the random value to obtain a new hash value in response to the cookie with the random value existing; comparing the new hash value with the hash value contained in the access token; and indicating the access token valid in response to the new hash value matching the hash value contained in the access token.
2. The method as recited in claim 1 , wherein the cookie is an HTTPOnly cookie.
3. The method as recited in claim 1 , wherein the server-side credential is the random value computed by a random value generator that cannot be accessed by the client.
4. The method as recited in claim 1 , wherein the access token comprises a JavaScript Object Notation (JSON) web token.
5. The method as recited in claim 1 , wherein the authorization protocol comprises an OAuth authorization protocol.
Cooperative Patent Classification codes for this invention. Click any code to explore related patents in that topic.
October 29, 2018
August 25, 2020
Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.